Samsung Routines CVE-2025-21058

Exploitation requires local access to the device - in practice an attacker-controlled app already installed and running on a Samsung Galaxy phone - which then abuses improper access control in the Samsung Routines component (versions prior to 4.8.7.1 on Android 15 and 4.9.6.0 on Android 16) to execute code with SystemUI privilege. Limiting factors: the attack is not remote (AV:L), so the adversary must first get code onto the device; however, no elevated privileges (PR:N) and no user interaction (UI:N) are needed once a local app is present, and the affected Routines versions ship by default on the targeted Android 15/16 Samsung builds, so default configurations are affected.

This is a moderate, locally-exploitable privilege/code-execution flaw rather than a top-tier emergency. The provided CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, 7.3) establishes that exploitation requires LOCAL access - consistent with the description's 'local attackers' language - so there is no remote network exposure. EPSS is very low (0.14%, 3rd percentile), indicating no modeled likelihood of widespread opportunistic exploitation. There is no CISA KEV listing and no public exploit was identified in the provided data, so there is no evidence of active exploitation. The signals are internally consistent (local vector + low EPSS + no KEV all point to limited real-world urgency), with one notable tension: the vendor-supplied impact metrics rate confidentiality and integrity only Low (C:L/I:L) despite the description stating a local attacker can 'execute arbitrary code with SystemUI privilege' - arbitrary code execution at a privileged system context would typically warrant higher C/I. This under-scoring should be verified with Samsung. No CWE was supplied, and no attack-complexity caveats (e.g., a race or specific pre-installed malicious app) are documented. Bottom line: a legitimately patch-worthy local privilege-escalation/code-execution bug on Samsung devices, but not a drop-everything issue absent evidence of exploitation.

A malicious or trojanized app installed on a Samsung Galaxy device abuses improper access control in the Routines component to run its own code in the SystemUI process context, escaping its own sandbox to gain SystemUI-level privileges. Because the CVSS vector is AV:L/AC:L/PR:N/UI:N, no additional permissions or user interaction are needed beyond getting the attacker's app onto the device. No public proof-of-concept exploit was identified in the available data.